Cloud-scale ingestion
Native connectors for Microsoft, AWS*, Google Cloud* and SaaS; agents and syslog/CEF forwarders for everything on-premises.
40+ source typesXcellSecure|Next-Gen SIEM
Every log in one cloud data platform. Detections written as code. A 24×7 SOC watching it.
Advanced security information & event management on Microsoft Sentinel — hot and cold data tiers, one schema across vendors, built-in UEBA and SOAR, run from Mumbai.
Analytics tier + data lake
ASIM-normalised data
Detection-as-code
MITRE ATT&CK v20 mapped
24×7 SOC · Mumbai
Azure India regions
✦Ask AI about NG-SIEMChatGPTClaudePerplexityGoogle AICopilot
01Ingest · six sources, two tiers
Built on · run by
Microsoft Sentinel
XcellHost · Microsoft Gold Partner
Plans from ₹49,999 / month24×7 SOC · MumbaiCERT-In 6 h · 180 d logsWorkspaces in Azure IndiaGST invoice in INRSince 1999
What it is
A SIEM collects and correlates security logs. A next-gen SIEM does it at cloud scale, as code.
The job hasn't changed: gather events from every system, find the attacks hidden in them, and give analysts one place to investigate. What changed is how much data there is, where it lives and how fast teams need to act.
| Area | Legacy SIEM | Next-gen SIEM (XcellSecure) |
|---|---|---|
| Platform | Appliances or VMs you size, patch and scale | Cloud-native service; capacity grows with ingest |
| Storage | One expensive hot store; old data archived offline | Analytics tier for detection + low-cost data lake, still queryable |
| Data model | Per-vendor parsers; queries rewritten for each source | Normalised schema (ASIM in Sentinel); one query across vendors |
| Detections | Rules edited in a console, rarely versioned | Detection-as-code: Git, peer review, tests, CI/CD deploy |
| Behaviour | Separate UEBA product, if any | UEBA built in — baselines, peer groups, anomaly scores |
| Response | Manual tickets and email | SOAR playbooks and automation rules in the same platform |
| Investigation | Hand-written queries | AI assistant summarises incidents and drafts queries (optional) |
| Cost model | Licence by EPS or appliance, plus hardware | Pay per GB ingested, tiered by value; commitment tiers when steady |
Who needs one?
Any organisation that must keep and review logs — CERT-In asks every service provider, intermediary, data centre and body corporate to keep ICT logs for 180 days in India — and anyone outgrowing an on-premises SIEM's storage bill.
Why managed
The platform is half the work. Tuning, hunting, triage at 3 a.m. and the CERT-In call are the other half — that's what our 24×7 SOC does.
Architecture
Six layers from raw log to closed incident. Hover any block.
The reference design we deploy for Indian customers, on Microsoft Sentinel in the Defender portal. Partner SIEMs follow the same layers.
* Partner or third-party products, trademarks of their owners. Sentinel runs in the Microsoft Defender portal; Microsoft has said the Azure-portal experience is supported until 31 March 2027.
Key capabilities
Eight things a modern SIEM must do. All eight, configured and run.
We don't hand over an empty workspace. Every capability below is switched on, tuned for your sources and reviewed monthly.
Tiered data lake
Security-relevant tables in the analytics tier; bulky, low-signal logs in the data lake for 1–2 years at a fraction of the cost.
Hot + coldSchema normalisation
ASIM parsers map firewalls, identity and endpoints to one field set, so one detection covers every vendor. OCSF and UDM on partner SIEMs.
ASIM · OCSF*Detection-as-code
Rules live in Git with ATT&CK tags, peer review and test data; a pipeline deploys them to your workspace. Sigma import supported.
CI/CDBuilt-in UEBA
Behaviour baselines for users, hosts and service accounts; anomaly scores enrich every incident. Deep dive on our UEBA page.
Peers · baselinesCorrelation into incidents
Alerts from identity, endpoint, email and network grouped by entity and time, so analysts work one incident, not fifty alerts.
Fusion · groupingSOAR & automation
Playbooks enrich, contain and notify: revoke sessions, isolate a device, block an IP, open a ticket, start the case.
Logic AppsAI-assisted investigation
Optional Security Copilot summarises incidents, explains scripts and drafts KQL. Analysts verify before acting — AI never closes a case alone.
OptionalMITRE ATT&CK · Enterprise v20
Coverage starts with data. Pick your sources, see your blind spots.
A planning aid, not a score. Detections only work on tactics your logs can see — switch sources on and off to find where you are blind. We map our deployed rules to the same 15 tactics in your monthly report.
Sources you send to the SIEM
Seen by 3+ sources1–2 sourcesBlind spot—
Since ATT&CK v19 (April 2026) the former Defense Evasion tactic is split into Stealth (TA0005) and Defense Impairment (TA0112); v20 was released on 13 October 2026. Source-to-tactic links are XcellHost's planning view, not an official MITRE mapping, and show visibility — not detection coverage.
Tool · ingest & cost estimator
Sources × events per second. GB/day, Azure cost and the plan that fits.
Enter how many of each source you run. We turn average events per second into GB per day, split it between the analytics tier and the data lake, and price both — illustrative, using the same rates as our Sentinel pages.
SourceCountEPS eachGB/dayTier
Retention 180 days · CERT-In minimum
Quick profile
Estimate · illustrative
0GB / day ingested
Analytics 0Data lake 0
Rates used (illustrative placeholders*)
- Analytics ingestion ₹430 / GB
- Analytics retention after 90 d ₹9 / GB / month
- Data lake ingest + processing ₹12 / GB
- Data lake storage ₹2 / GB / month (6:1 compression)
Same placeholders as our Sentinel implementation estimator — per Microsoft pricing, confirm. Some Microsoft sources ingest free and Microsoft 365 E5-family licences include a daily data grant; both reduce the real bill.
Event sizes and EPS defaults are typical planning values, not measurements of your estate. A two-week log sample in our Sentinel Readiness Assessment replaces them with real numbers.
Tool · detection-as-code tuner
Every rule is a trade-off. Tune one against sample data.
A brute-force-then-success rule run over two hours of synthetic sign-ins from 12 pseudonymised accounts. Two contain a planted attack; the rest are normal users and noisy service accounts. Change the rule and watch the alerts and the code change together.
Window
Alerts0
Attacks caught0/2
False positives0
Synthetic data, pseudonymised account IDs (u_xxxx). The rule is a teaching example tagged ATT&CK T1110 Brute Force (Credential Access); in production we test every rule against replayed data before it ships.
Integrations
Microsoft-first. Not Microsoft-only.
We build on Microsoft Sentinel and Defender XDR as a Microsoft Gold Partner, connect the rest of your estate, and can run your existing partner SIEM if you're not ready to move.
Microsoft Sentinel
SIEM + SOAR, analytics tier and data lake, in the Defender portal.
Defender XDR
Endpoint, identity, email and cloud-app incidents flow in with one click.
Microsoft Defender →Entra ID
Sign-in, audit and risk events for identity detections.
Microsoft 365
Exchange, SharePoint and Teams audit — ingested free.
Microsoft 365 E5 →Security Copilot
Optional AI assistant for investigation and KQL drafting.
Defender for Cloud
Posture and workload alerts for Azure, AWS* and Google Cloud*.
CNAPP →Splunk Enterprise Security*
Co-manage your Splunk* deployment, or migrate detections and dashboards to Sentinel.
Elastic Security*
Elastic Common Schema and detection rules supported; same SOC runbooks.
Google Security Operations*
Formerly Chronicle; UDM-normalised data. Co-managed on request.
Wazuh* (open source)
Open-source SIEM/XDR on XcellHost cloud in Mumbai for budget-led deployments.
Vortex SOC
Our self-run or co-managed SOC platform option.
Vortex SOC →OCSF*
Open schema used by several partner platforms; we map to it where the SIEM supports it.
Firewalls
Fortinet*, Palo Alto Networks* and others via CEF/syslog.
Fortinet services →Network detection
NDR and Zeek*/Suricata* metadata for east-west visibility.
NDR →Other EDR
SentinelOne* and Scrutiny EDR alerts into the same incident queue.
SentinelOne →AWS* · Google Cloud*
CloudTrail*, GuardDuty*, Cloud Audit Logs* via native connectors.
Servers & databases
Windows events, Linux syslog, SQL audit through the Azure Monitor Agent.
OT & IoT
Passive OT sensors and historians, via a one-way forwarder.
OT assessment →ServiceNow*
Bi-directional incident sync with status and comments.
Jira Service Management*
Tickets opened and updated by playbook.
Zoho Desk*
Tickets for teams that run support on Zoho.
Teams · email · WhatsApp
On-call notifications and approvals for containment.
Case management
Evidence, chain of custody and regulator timers.
Case Management →Phishing response
User-reported email triaged in the same queue.
Phishing IR →* Partner or third-party products, trademarks of their owners. XcellHost is a Microsoft Gold Partner; other names are listed for integration only and don't imply a partnership.
Why it matters in India
Four rulebooks expect logs, monitoring and fast reporting. An NG-SIEM is how you prove it.
General information, not legal advice. Your regulator's latest text prevails.
CERT-In directions · 28 April 2022
6 hto report specified cyber incidents
180 drolling ICT log retention, within India
Clocks synchronised to NIC or NPL time sources. We flag reportable incidents and build the evidence pack while the incident runs.
DPDP Act, 2023 & Rules, 2025
Reasonable security safeguards and breach intimation to the Data Protection Board and each affected person without delay, with a detailed report to the Board within 72 hours. Core duties apply from 13 May 2027. DPDP platform →
RBI · banks & regulated entities
RBI's 2016 Cyber Security Framework expects banks to run a Security Operations Centre for continuous monitoring, and later IT-governance directions keep that expectation for regulated entities.
SEBI CSCRF · 20 August 2024
SEBI-regulated entities must be monitored by a SOC — their own, a group SOC, a third-party managed SOC or the Market SOC run by NSE/BSE for smaller entities.
Data residency
Sentinel workspaces in Central India by default (Jio India West and Central are also supported); Wazuh* runs in our Mumbai Tier IV data centre.
How XcellHost delivers
Designed in two weeks. Watched 24×7 after that.
Same team from design to the 3 a.m. call: certified Microsoft security engineers and SOC analysts in Mumbai.
01Assess
Log sample, source inventory, ATT&CK gap map and a cost model.
Week 1–202Build
Workspace in India, connectors, tiering, ASIM parsers, RBAC.
Week 2–403Detect
Rule packs from Git, UEBA on, playbooks tested on replayed data.
Week 4–604Operate
24×7 triage, monthly hunting, tuning and a report you can give the board.
OngoingPlans · per month
Priced by daily log volume. Azure consumption billed at cost.
Same plans and prices as our Managed Microsoft Sentinel page. Indicative, excl. 18% GST.
Essentials
Up to 10 GB/day
₹49,999/ month
Onboarding ₹74,999 one-time
- 8×5 monitoring + 24×7 critical alerts
- 50 ATT&CK-mapped use cases
- Connector health monitoring
- Monthly report
Most chosen Professional
Up to 50 GB/day
₹1,24,999/ month
Onboarding ₹1,49,999 one-time
- 24×7 SOC monitoring & response
- 150 ATT&CK-mapped use cases
- SOAR playbooks built & run
- Monthly threat hunting
- Monthly tuning review
Enterprise
Up to 150 GB/day
₹2,99,999/ month
Onboarding ₹2,99,999 one-time
- 24×7 dedicated analysts
- Custom detections for your apps
- Weekly threat hunting
- Quarterly business review
- Priority escalation
Partner SIEM
Splunk* · Elastic* · Google SecOps* · Wazuh*
On quote
Co-managed or fully managed
- Same 24×7 SOC and runbooks
- Detections in your SIEM's language
- Migration path to Sentinel
Extra volume ₹1,999 per GB/day per month. Prices as on Managed Microsoft Sentinel, Sentinel implementation and Security Operations — indicative, excl. 18% GST; Microsoft Azure consumption is billed separately at Microsoft's rates.
Configure
Build your NG-SIEM. See the first invoice.
Pick a plan and daily volume; add migration, assessment and reporting. First invoice = one-time items plus the first month.
Plan
Your estimate · indicative
XcellSecure NG-SIEM
Monthly₹0
One-time₹0
Subtotal (first invoice)₹0
GST 18%₹0
₹0
first invoice incl. GST · then ₹0/month incl. GST
Prices as on the linked XcellHost pages, indicative, excl. 18% GST in the lines above. Azure consumption billed separately.
FAQ
NG-SIEM, answered.
Four things: it runs as a cloud service that scales with your data; it stores data in tiers so long retention is affordable; it normalises every vendor to one schema; and detection, behaviour analytics (UEBA) and automated response (SOAR) are part of the same platform. Detection-as-code and an optional AI assistant complete the picture.
Microsoft Sentinel by default — XcellHost is a Microsoft Gold Partner and Sentinel works natively with Defender XDR, Entra ID and Microsoft 365. If you already run Splunk*, Elastic*, Google Security Operations* or Wazuh*, our SOC can co-manage it or plan a migration.
Both are schemas that give security data common field names. ASIM (Advanced Security Information Model) is Microsoft Sentinel's normalisation layer, applied through parsers at query time or during ingestion. OCSF (Open Cybersecurity Schema Framework) is an open, vendor-neutral schema project under the Linux Foundation used by several other platforms; Google Security Operations uses its own Unified Data Model (UDM).
Each rule is a file in a Git repository with its query, ATT&CK tags, severity, owner and test data. Changes go through review, are tested against sample logs and are deployed to your workspace by a pipeline. You get history, rollback and the same rules across every tenant we run.
It depends on volume and tiering. Use the estimator for a rough figure; it uses the same illustrative rates as our Sentinel pages (₹430 per GB into the analytics tier, ₹12 per GB into the data lake). Some Microsoft sources ingest free, E5-family licences include a daily data grant and commitment tiers start at 100 GB/day. Azure consumption is billed at Microsoft's rates, separately from our plan.
At least 180 days, to meet the CERT-In directions — in Indian Azure regions. Security-relevant tables usually stay in the analytics tier for 90 days to a year; bulky logs go to the data lake for one to two years and remain searchable.
Yes. Every incident carries a reportability check; if it looks reportable we prepare the evidence pack (timeline, indicators, affected systems) during the incident and help you file. A monthly CERT-In incident reporting retainer (₹14,999, as on Managed Sentinel) is available in the configurator. The decision to report stays with you.
Yes — a one-time SIEM migration at ₹1,99,999 (indicative, as on Managed Sentinel) covers use-case inventory, rule translation, parallel running and cut-over. Historical logs usually move to the data lake rather than being re-ingested into the analytics tier.
The SIEM is the hub. UEBA adds behaviour baselines, NDR adds network signal, and Case Management runs the incident from triage to closure with evidence and regulator timers. All four share one incident queue in our SOC.
No. They're the indicative prices published on our Managed Microsoft Sentinel, Sentinel implementation and Security Operations pages, excl. 18% GST, and are confirmed in a written INR quotation. Azure consumption and the tool's ingestion rates are illustrative and billed at Microsoft's actual rates.